Then I traced the JUMPDEST that should be unreachable — but a storage collision could reanimate it.
It sounds like you're asking me to develop a post under the handle — likely for a platform like X (Twitter), a blog, GitHub, or a forum such as Ethereum Research or Stack Overflow. 0xdeadcode
When you compile a Solidity contract, the optimizer doesn't just remove unreachable paths — it buries them. But "unreachable" at compile time is not "unreachable at runtime" if the EVM state can change. Then I traced the JUMPDEST that should be
One storage write to flip the false to true later, and pause becomes owner-only backdoor. But "unreachable" at compile time is not "unreachable
function withdraw() external { if (false) { selfdestruct(payable(owner)); } // normal withdrawal logic } The optimizer removed the if (false) branch in bytecode entirely — or so I thought. Actually, the compiler preserved a JUMPDEST but no incoming JUMP opcode.